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Ten years ago, it was al Qaeda in Iraq videos on YouTube. A few years later, al Shabaab's 
deadly rampages played out on Twitter. Shortly after, Facebook groups and Twitter 
feeds brought the Islamic State to the world's attention and into the homes of new 
recruits, before they scurried off to other social media applications like Telegram. And 
four years ago amongst global jihad's social media storm, I stumbled into Russian 
influence campaigns, their reboot of an old playbook called "Active Measures", which 
they've deployed across nearly all social media platforms with devastating effect. 

Today, disinformation spread on Facebook propels deadly violence in Myanmar against 
the minority Ronhingya population. 1 The Duterte regime in the Philippines uses social 
media groups to suppress domestic political opponents." LTG H.R. McMaster, our 
National Security Advisor, noted just last week the Kremlin is again using its cyber 
influence just across our southern border seeking to push their preferred party and 
politicians to the forefront in Mexico. 1 " 

Social media, at its height, offered a platform for discussion across diverse audiences 
and led to uprisings usurping dictators during the Arab Spring. But bad actors with 
motivation, money, manpower and know-how will always come to these information 
gateways to pursue their objectives. Criminals, terrorists and authoritarians see the 
Internet and social media as a cost effective open doorway into the very heart of their 
adversaries. Authoritarians worldwide now recognize the power of the Kremlin's social 
media manipulation, and if left unchecked, will copy and deploy Russia's playbook 
against their enemies. Lesser-educated populations around the world predominately 
arriving in cyberspace via mobile phones will be particularly vulnerable to the social 
media manipulation of terrorists and authoritarians. 

American focus on the Islamic State's social media recruitment or Russian meddling in 
the 2016 Presidential election overlooks other indicators of damaging activity. 

American companies have suffered and remain particularly vulnerable to smear 
campaigns launched by foreign state actors through malicious, false narratives pushed 
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by bogus social media personas. These campaigns can cause serious reputational 
damage sending stock prices plummeting and decreasing sales. 

Beyond just smear campaigns and character assassination, this committee should take 
seriously the ability of foreign nations to mobilize violence inside the U.S. through an 
evolution I would call "Anwar Awlaki meets PizzaGate". Just a few years ago, Anwar al- 
Awlaki, al Qaeda in the Arabian Peninsula's leader of external operations, recognized 
the power of the Internet to recruit and mobilize terrorists in America to conduct 
violence in the U.S. homeland. The Islamic State took this to another level with their 
spokesman abu Muhammad al-Adnani calling on supporters to conduct attacks at 
home lv and then further enabling e-recruits by using a social media battalion to guide 
plots remotely - connecting with, coaching and directing terrorists in the West to 
specific targets/ A little over a year ago, America saw an individual consume a false 
conspiracy on the Internet and social media, known as PizzaGate, and then travel to 
Washington DC to investigate these bogus claims. He arrived at a falsely implicated 
restaurant and discharged a weapon before being arrested. Vl 

Surely a foreign adversary of the United States sees an opportunity in combining these 
two scenarios. The greatest concern moving forward might likely be a foreign 
intelligence service, posing as Americans on social media, infiltrating one or both 
political extremes in the U.S. and then recruiting unwitting Americans to undertake 
violence against a target of the foreign power's choosing. Social media companies will 
be better positioned to stop this potential scenario from occurring than U.S. intelligence 
or homeland security that are blind to the technical signatures behind this manipulation. 

The U.S. government's response to terrorist social media use has been sustained and 
significant, and their response to state sponsored influence on Americans disjointed and 
perplexing. In both cases, government officials have pointed to social media companies 
asking why they would allow their platforms to be used for nefarious purposes. 

Social media companies realize the damage of these bad actors far too late. They race to 
implement policies to prevent the last information attack, but have yet to anticipate the 
next abuse of their social media platforms by emerging threats seeking to do bad things 
to good people. In previous testimony to the Senate Homeland Security VM , lntelligence vl ". 
Armed Services lx and Judiciary x committees. I've offered a range of recommendations 
for how to counter bad actors using social media in the pursuit of violence and nefarious 
influence. Today, I'll focus and reiterate a few of these recommendations. 

The first and most pressing challenge comes in the debate over social media account 
anonymity and authenticity. Anonymity of social media accounts has in many cases 
allowed the oppressed and the downtrodden to speak out about injustice. It's given the 
weak a voice against the strong, powerful, and corrupt. But over time, anonymity has 
empowered hackers, extremists and authoritarians to inflict harm on the public. Under 
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the veil of anonymity, they spread hate, recruit members and advance divisions in 
American society. 

All people, real humans and their virtual personas, have the right to free speech, but this 
right to free speech does not permit them to endanger society. Account anonymity 
today allows nefarious social media personas to shout the online equivalent of "fire" in 
a movie theater. Bad actors and their fictitious and/or anonymous social media accounts 
can and have created a threat to public safety. This is not protected free speech and 
many social media companies offer no method to hold these anonymous personas 
accountable. 

Social media companies can and should protect the public anonymity of account holders 
if the user chooses, but they must be able to determine a real, authentic person resides 
behind each persona accountable for their actions on the platform. Some social media 
companies have advanced better methods to certify account authenticity. However, the 
current level of authenticity on the Twitter platform is sub-optimal. I'd encourage 
Twitter to rapidly expand its verification to as many users as possible, as quickly as 
possible. 

Closely connected to the issue of account authenticity is the rise of computational 
propaganda. The negative effects of social bots far outweigh any benefits. The 
anonymous, replication of accounts that routinely broadcast high volumes of 
misinformation can pose a serious risk to public safety and when employed by 
authoritarians a direct threat to democracy. Social bots should be ceased immediately. 
For non-automated accounts, reasonable limits on the number of posts any account can 
make during an hour, day or week should be developed. Even further, human 
verification systems (CAPTCHA) should be employed by all social media companies to 
reduce automated broadcasting. 

Federal laws governing attribution of political ads and solicitations in television, radio 
and print should immediately be extended to social media advertising conducted by 
political campaigns and political action committees. Social media political advertising 
will continue to grow in every election cycle and U.S. citizens must know the source of 
the information they consume in any medium - print, radio, television or social media. 

Social media companies continue to get beat in part because they rely too heavily on 
technologists and technical detection to catch bad actors. Artificial intelligence and 
machine learning will greatly assist in cleaning up nefarious activity, but will for the near 
future, fail to detect that which hasn't been seen before. Threat intelligence proactively 
anticipating how bad actors will use social media platforms to advance their cause must 
be used to generate behavioral indicators that inform technical detection. Those that 
understand the intentions and actions of criminals, terrorists and authoritarians must 
work alongside technologists to sustain the integrity of social media platforms. Some 
social media companies have already moved in this direction. 
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I'd note it's unreasonable to think that every social media company can and should hire 
threat analysts for every possible emerging threat. But a variety of rapid outreach 
approaches with external social media analysts and threat experts positioned outside 
social media companies could easily be developed or even be collectively sponsored by 
social media companies. Several models from counterterrorism and cybersecurity could 
be adopted by Silicon Valley in this regard. 

I've made many other recommendations in the past but will close for now and can 
elaborate further on them during the question and answer session. In conclusion, some 
social media companies have done more than others to improve the safety and integrity 
of their platforms. Others have a lot of work to do to improve their platforms against 
bad actors. Ultimately, the American consumer will decide whether the benefits of using 
these services outweigh the risks. Many are walking away from social media applications 
because they can't trust the information being shared or tolerate the vitriolic user 
experience. Social media companies should move aggressively to thwart terrorists and 
authoritarians exploiting their systems not only because its what's best for their users 
and society, but because it's good for business as well. 
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